net/mlx5e: Add MACsec offload SecY support
Add offload support for MACsec SecY callbacks - add/update/delete. add_secy is called when need to create a new MACsec interface. upd_secy is called when source MAC address or tx SC was changed. del_secy is called when need to destroy the MACsec interface. Signed-off-by: Lior Nahmanson <liorna@nvidia.com> Reviewed-by: Raed Salem <raeds@nvidia.com> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Lior Nahmanson
David S. Miller
parent
b7c9400cbc
commit
5a39816a75
@ -66,6 +66,7 @@ struct mlx5e_macsec {
|
|||||||
/* Rx fs_id -> rx_sc mapping */
|
/* Rx fs_id -> rx_sc mapping */
|
||||||
struct xarray sc_xarray;
|
struct xarray sc_xarray;
|
||||||
|
|
||||||
|
unsigned char *dev_addr;
|
||||||
struct mlx5_core_dev *mdev;
|
struct mlx5_core_dev *mdev;
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -243,6 +244,42 @@ static int mlx5e_macsec_update_rx_sa(struct mlx5e_macsec *macsec,
|
|||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static bool mlx5e_macsec_secy_features_validate(struct macsec_context *ctx)
|
||||||
|
{
|
||||||
|
const struct net_device *netdev = ctx->netdev;
|
||||||
|
const struct macsec_secy *secy = ctx->secy;
|
||||||
|
|
||||||
|
if (secy->validate_frames != MACSEC_VALIDATE_STRICT) {
|
||||||
|
netdev_err(netdev,
|
||||||
|
"MACsec offload is supported only when validate_frame is in strict mode\n");
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (secy->icv_len != MACSEC_DEFAULT_ICV_LEN) {
|
||||||
|
netdev_err(netdev, "MACsec offload is supported only when icv_len is %d\n",
|
||||||
|
MACSEC_DEFAULT_ICV_LEN);
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!secy->protect_frames) {
|
||||||
|
netdev_err(netdev,
|
||||||
|
"MACsec offload is supported only when protect_frames is set\n");
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (secy->xpn) {
|
||||||
|
netdev_err(netdev, "MACsec offload: xpn is not supported\n");
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (secy->replay_protect) {
|
||||||
|
netdev_err(netdev, "MACsec offload: replay protection is not supported\n");
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
static int mlx5e_macsec_add_txsa(struct macsec_context *ctx)
|
static int mlx5e_macsec_add_txsa(struct macsec_context *ctx)
|
||||||
{
|
{
|
||||||
const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
|
const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
|
||||||
@ -764,6 +801,195 @@ out:
|
|||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int mlx5e_macsec_add_secy(struct macsec_context *ctx)
|
||||||
|
{
|
||||||
|
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
|
||||||
|
const struct net_device *dev = ctx->secy->netdev;
|
||||||
|
const struct net_device *netdev = ctx->netdev;
|
||||||
|
struct mlx5e_macsec *macsec;
|
||||||
|
int err = 0;
|
||||||
|
|
||||||
|
if (ctx->prepare)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
if (!mlx5e_macsec_secy_features_validate(ctx))
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
|
mutex_lock(&priv->macsec->lock);
|
||||||
|
|
||||||
|
macsec = priv->macsec;
|
||||||
|
|
||||||
|
if (macsec->dev_addr) {
|
||||||
|
netdev_err(netdev, "Currently, only one MACsec offload device can be set\n");
|
||||||
|
err = -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
macsec->dev_addr = kzalloc(dev->addr_len, GFP_KERNEL);
|
||||||
|
if (!macsec->dev_addr) {
|
||||||
|
err = -ENOMEM;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(macsec->dev_addr, dev->dev_addr, dev->addr_len);
|
||||||
|
out:
|
||||||
|
mutex_unlock(&macsec->lock);
|
||||||
|
|
||||||
|
return err;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int macsec_upd_secy_hw_address(struct macsec_context *ctx)
|
||||||
|
{
|
||||||
|
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
|
||||||
|
const struct net_device *dev = ctx->secy->netdev;
|
||||||
|
struct mlx5e_macsec *macsec = priv->macsec;
|
||||||
|
struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
|
||||||
|
struct mlx5e_macsec_sa *rx_sa;
|
||||||
|
struct list_head *list;
|
||||||
|
int i, err = 0;
|
||||||
|
|
||||||
|
|
||||||
|
list = &macsec->macsec_rx_sc_list_head;
|
||||||
|
list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) {
|
||||||
|
for (i = 0; i < MACSEC_NUM_AN; ++i) {
|
||||||
|
rx_sa = rx_sc->rx_sa[i];
|
||||||
|
if (!rx_sa || !rx_sa->macsec_rule)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
mlx5e_macsec_cleanup_sa(macsec, rx_sa, false);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) {
|
||||||
|
for (i = 0; i < MACSEC_NUM_AN; ++i) {
|
||||||
|
rx_sa = rx_sc->rx_sa[i];
|
||||||
|
if (!rx_sa)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
if (rx_sa->active) {
|
||||||
|
err = mlx5e_macsec_init_sa(ctx, rx_sa, false, false);
|
||||||
|
if (err)
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
memcpy(macsec->dev_addr, dev->dev_addr, dev->addr_len);
|
||||||
|
out:
|
||||||
|
return err;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* this function is called from 2 macsec ops functions:
|
||||||
|
* macsec_set_mac_address – MAC address was changed, therefore we need to destroy
|
||||||
|
* and create new Tx contexts(macsec object + steering).
|
||||||
|
* macsec_changelink – in this case the tx SC or SecY may be changed, therefore need to
|
||||||
|
* destroy Tx and Rx contexts(macsec object + steering)
|
||||||
|
*/
|
||||||
|
static int mlx5e_macsec_upd_secy(struct macsec_context *ctx)
|
||||||
|
{
|
||||||
|
const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
|
||||||
|
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
|
||||||
|
const struct net_device *dev = ctx->secy->netdev;
|
||||||
|
struct mlx5e_macsec_sa *tx_sa;
|
||||||
|
struct mlx5e_macsec *macsec;
|
||||||
|
int i, err = 0;
|
||||||
|
|
||||||
|
if (ctx->prepare)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
if (!mlx5e_macsec_secy_features_validate(ctx))
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
|
mutex_lock(&priv->macsec->lock);
|
||||||
|
|
||||||
|
macsec = priv->macsec;
|
||||||
|
|
||||||
|
/* if the dev_addr hasn't change, it mean the callback is from macsec_changelink */
|
||||||
|
if (!memcmp(macsec->dev_addr, dev->dev_addr, dev->addr_len)) {
|
||||||
|
err = macsec_upd_secy_hw_address(ctx);
|
||||||
|
if (err)
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (i = 0; i < MACSEC_NUM_AN; ++i) {
|
||||||
|
tx_sa = macsec->tx_sa[i];
|
||||||
|
if (!tx_sa)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
mlx5e_macsec_cleanup_sa(macsec, tx_sa, true);
|
||||||
|
}
|
||||||
|
|
||||||
|
for (i = 0; i < MACSEC_NUM_AN; ++i) {
|
||||||
|
tx_sa = macsec->tx_sa[i];
|
||||||
|
if (!tx_sa)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
if (tx_sa->assoc_num == tx_sc->encoding_sa && tx_sa->active) {
|
||||||
|
err = mlx5e_macsec_init_sa(ctx, tx_sa, tx_sc->encrypt, true);
|
||||||
|
if (err)
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
out:
|
||||||
|
mutex_unlock(&macsec->lock);
|
||||||
|
|
||||||
|
return err;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int mlx5e_macsec_del_secy(struct macsec_context *ctx)
|
||||||
|
{
|
||||||
|
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
|
||||||
|
struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
|
||||||
|
struct mlx5e_macsec_sa *rx_sa;
|
||||||
|
struct mlx5e_macsec_sa *tx_sa;
|
||||||
|
struct mlx5e_macsec *macsec;
|
||||||
|
struct list_head *list;
|
||||||
|
int i;
|
||||||
|
|
||||||
|
if (ctx->prepare)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
mutex_lock(&priv->macsec->lock);
|
||||||
|
|
||||||
|
macsec = priv->macsec;
|
||||||
|
|
||||||
|
for (i = 0; i < MACSEC_NUM_AN; ++i) {
|
||||||
|
tx_sa = macsec->tx_sa[i];
|
||||||
|
if (!tx_sa)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
mlx5e_macsec_cleanup_sa(macsec, tx_sa, true);
|
||||||
|
mlx5_destroy_encryption_key(macsec->mdev, tx_sa->enc_key_id);
|
||||||
|
kfree(tx_sa);
|
||||||
|
macsec->tx_sa[i] = NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
list = &macsec->macsec_rx_sc_list_head;
|
||||||
|
list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) {
|
||||||
|
for (i = 0; i < MACSEC_NUM_AN; ++i) {
|
||||||
|
rx_sa = rx_sc->rx_sa[i];
|
||||||
|
if (!rx_sa)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
mlx5e_macsec_cleanup_sa(macsec, rx_sa, false);
|
||||||
|
mlx5_destroy_encryption_key(macsec->mdev, rx_sa->enc_key_id);
|
||||||
|
kfree(rx_sa);
|
||||||
|
rx_sc->rx_sa[i] = NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
list_del_rcu(&rx_sc->rx_sc_list_element);
|
||||||
|
|
||||||
|
kfree_rcu(rx_sc);
|
||||||
|
}
|
||||||
|
|
||||||
|
kfree(macsec->dev_addr);
|
||||||
|
macsec->dev_addr = NULL;
|
||||||
|
|
||||||
|
mutex_unlock(&macsec->lock);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
static bool mlx5e_is_macsec_device(const struct mlx5_core_dev *mdev)
|
static bool mlx5e_is_macsec_device(const struct mlx5_core_dev *mdev)
|
||||||
{
|
{
|
||||||
if (!(MLX5_CAP_GEN_64(mdev, general_obj_types) &
|
if (!(MLX5_CAP_GEN_64(mdev, general_obj_types) &
|
||||||
@ -805,6 +1031,9 @@ static const struct macsec_ops macsec_offload_ops = {
|
|||||||
.mdo_add_rxsa = mlx5e_macsec_add_rxsa,
|
.mdo_add_rxsa = mlx5e_macsec_add_rxsa,
|
||||||
.mdo_upd_rxsa = mlx5e_macsec_upd_rxsa,
|
.mdo_upd_rxsa = mlx5e_macsec_upd_rxsa,
|
||||||
.mdo_del_rxsa = mlx5e_macsec_del_rxsa,
|
.mdo_del_rxsa = mlx5e_macsec_del_rxsa,
|
||||||
|
.mdo_add_secy = mlx5e_macsec_add_secy,
|
||||||
|
.mdo_upd_secy = mlx5e_macsec_upd_secy,
|
||||||
|
.mdo_del_secy = mlx5e_macsec_del_secy,
|
||||||
};
|
};
|
||||||
|
|
||||||
bool mlx5e_macsec_handle_tx_skb(struct mlx5e_macsec *macsec, struct sk_buff *skb)
|
bool mlx5e_macsec_handle_tx_skb(struct mlx5e_macsec *macsec, struct sk_buff *skb)
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user